(U//FOUO) TTPs Used in Recent US Pipeline Attacks by Suspected 
Environmental Rights Extremists 


(U//FOUO) Prepared by the Montana Analysis and Technical Information Center (MATIC), Minnesota Fusion Center 
(MNFC), North Dakota State and Local Intelligence Center (NDSLIC), South Dakota Fusion Center (SDFC), Washington 
State Fusion Center (WSFC), the Illinois Statewide Terrorism & Intelligence Center (STIC), and the Iowa Division of 
Intelligence and Fusion Center (DOI/FC) jointly with the DHS Office of Intelligence and Analysis (l&A) and coordinated with 
Transportation Security Administration (TSA). 

(U) Scope: This Field Analysis Report (FAR) highlights recent criminal disruptions and violent incidents against pipeline 
projects in the Midwestern and Western United States in 2016, and shows how activities at these events compare with 
larger environmental rights extremist strategic trends—including those related to targeting, tactics and procedures (TTPs).'T 
This product is intended to assist government and law enforcement security partners in identifying, deterring, preventing, 
and responding to potential threats against pipelines and related entities. It includes a discussion of drivers possibly 
affecting the future threat of pipeline-related violence from environmental rights extremist violence. 

(U) Key Judgments 

• (U//FOUO) We assess the October 2016 valve shutoff attacks against five pipelines along the US- 
Canada border by suspected environmental rights extremists showed a high level of pre-operational 
planning. 

• (U//LES) We assess suspected environmental rights extremists exploited Native American causes in 
furtherance of their own violent agenda during a campaign to halt construction of the Dakota Access 
Pipeline (DAPL) in the Midwest and Western United States in 2016.* 

• (U//FOUO) We assess that while some characteristics of a series of arsons against Iowa pipeline 
construction sites in 2016 could be indicative of an environmental rights extremist attack, other factors 
could reasonably suggest a possible non-ideological motive. This assessment is subject to change if 
new information emerges. Additionally, environmental rights extremism is a plausible motivation behind 
multiple attacks against construction equipment in North Dakota during the same period. 

• (U//LES) The TTPs observed during the 2016 incidents included but were not limited to: destroying 
property; using small teams for attacks; choosing remote and lightly guarded targets; wearing disguises; 
starting simple fires to create barricades; “doxing" government officials; using drones; using small 
improvised explosive devices (lEDs); and throwing projectiles and Molotov cocktails at officers^ 


* (U//FOUO) DFIS defines environmental rights extremists as groups or individuals who facilitate or engage in acts 
of unlawful violence against people, businesses, or government entities perceived to be destroying, degrading, or 
exploiting the natural environment. 

f (U//FOUO) DHS defines terrorism as any activity that involves an act that is dangerous to human life or potentially 
destructive to critical infrastructure or key resources, and is a violation of the criminal laws of the United States or of 
any state or other subdivision of the United States and appears to be intended to intimidate or coerce a civilian 
population to influence the policy of a government by intimidation or coercion, or to affect the conduct of a 
government by mass destruction, assassination, or kidnapping. 

* (U) For background information on DAPL, see Appendix A. 

§ (U) Doxing attacks often include posting on websites targeting individuals’ personal background, associates or 
family, place of employment, home address, or contact information. 
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• (U//FOUO) We assess environmental rights extremists are likely to use some of these same criminal 
and violent tactics in attempts to disrupt other energy projects elsewhere in the United States— 
including those related to pipeline construction—in the coming year. 

(U) Significant Incidents in 2016 

(U//FOUO) Pipelines and associated 
construction projects in the Midwestern and 
Western United States in 2016 were targeted 
with multiple criminal and violent acts designed 
to disrupt fossil fuel transportation infrastructure 
and impede or injure law enforcement. These 
include valve shutoffs along the northern border, 
destruction of construction equipment, and 
arson attacks against Iowa pipeline construction 
sites. 

(U) Valve Shutoffs along Northern 
Border 

(U//FOUO) We assess the October 2016 valve 
shutoff attacks against five pipelines along the 
US-Canada border by suspected environmental 
rights extremists showed a high level of pre- 
operational planning. Multiple teams— 
comprised of individuals who traveled from 
across the United States—conducted 
simultaneous attacks against remote valve sites, 
wore disguises, and executed contingency - 
plans. 7 - 12 The apparent ease with which these 
valve shutoff attacks were carried out .and the 
heavy media coverage they attracted'lead us to 
be concerned that other environmental rights 
extremists could also pursue coordinated 
attacks against the energy sector. Although 
these valve attacks did not'result in any loss of 
life, manually shutting pipeline valves carries an 
inherent risk of death or serious injury if a 
pipeline ruptures. 

• (U//LES) On 11 October 2016, suspected environmental rights extremists shut down five pipelines along 
the US-Canadian border in Minnesota, Montana, North Dakota, and Washington for over seven hours, 
resulting in estimated financial losses in the hundreds of thousands of dollars, according to DHS, court 
documents, law enforcement information, and press reporting. 13 - 18 Nine individuals were subsequently 
arrested on charges related to tampering with pipeline valves and preventing the transportation of 
petroleum. The subjects claimed to have targeted the pipelines to show solidarity with actions against 
DAPL. They also called on the President to use emergency powers to keep the pipelines closed and 
requested a total ban on new fossil fuel extractions and an immediate end to use of tar sands and 


(U) Environmental Rights Extremists 

(U//LES) Environmental rights extremists have a long 
history of committing violent acts across the United States 
against entities they perceive are damaging the 
environment. Since the movement’s inception in the 
1980s, adherents have been responsible for many 
criminal acts and threats of violence, such as arson, as 
well as hundreds of other criminal acts resulting in 
damages in the tens of millions of dollars to targeted 
corporations and businesses, including energy and 
transportation industry targets. 1 ’* 1 Motivations for 
violence tend to mirror those of the larger nonviolent 
environmentalist movement and include such factors as 
anger over perceived environmental destruction during 
the oil-drilling method known as “fracking," perceived 
environmental and habitat destruction during mining of 
Canadian tar sands oil that is shipped to the United States 
via pipelines, and by fears of contamination to water ' 
supplies in the event of future pipeline leaks. 2 ’ 3 -' 1 
Environmental rights extremists often consider 
themselves to be nonviolent because their attacks tend to 
be against property and are intended to only inflict 
economic damage. However, the use of some tactics— • 
such as shutting off pipeline vaives or committing arson to 
construction equipment used in building pipelines—carry 
an inherent risk of death or serious injury, regardless of 
intent. For example, pipelines can rupture as a result of 
tampering, and fires started by arson can inadvertently 
spread to non-targeted areas and result in serious 
injuries. Although some recent and historical ■ 
environmental rights extremist attacks and disrupted plots 
have involved use of lEDs, bombing attacks from the 
movement are uncommon. 5 ' 6 


‘ (U//FOUO) DHS recognizes that individuals associated with various groups and movements participated in criminal 
and violent acts against pipelines in 2016. For the purposes of this paper, these individuals are referred to as 
environmental rights extremists, as these campaigns were fundamentally about protecting the environment—whether 
that is opposing oil pipeline construction projects or protecting the indigenous water supply from pollution. 

1 (U) For other examples of environmental rights extremists attacks against the energy sector, see Appendix B. 
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coal, according to DHS reporting and an online press release from a group representing the 
individuals. 19 ’ 20 -' 

(U) OBSERVATIONS/TTPS 

(U//LES) Small Teams Used for Attacks: In each of the valve shutoff incidents, there were at 
least three participants—one initiating the shutdown and the other two filming the event, 
according to US Department of Energy and law enforcement reporting. 21 ’ 22 ’ 23 ’ 24 



(U//LES) Lightly Guarded / argeis 
Selected: Pipeline valve sites—such as those targeted in the attack—are typically located every 
10 to 15 miles along a pipeline and have minimal security, according to law enforcement 
reporting. 30 / 

(U//LES) Attackers Ciave Advance Notice to Pipeline Companies: Attackers made phone 
calls to pipeline operators in North Dakota and Minnesota to give advanced notice that a valve 
closure was imminent, according to media reporting. 31 ’ 32 


(U//LES) Disguises Worn During Attacks: Pictures posted to websites supportive of the valve 
attackers indicate they disguised themselves as pipeline employees to carry out their attacks, 
donning hard hats and reflective safety vests. 33 According to law enforcement reporting, the 
hard hats and reflective vests had a red “X” on them—a known symbol of their campaign to halt 
fossil fuel production. 34 


(U//LES) Many Attackers Traveled 
from Outside of State: Many of the 
attackers were from outside the area— 
some from as far away as Vermont and 
New York, according to court documents 
and law enforcement reporting. 26 27 ’ 28 
One female participants arrested for 
filming the shutdown of one of the 
pipelines in North Dakota claimed to 
have little knowledge of the other 
attackers’ plans to commit simultaneous 
pipeline attacks in the region. She, 
however, later admitted to law 
enforcement she had traveled by train 
from New York City with one of the 
individuals who planned to disrupt 
pipelines in Minnesota and stayed in the 
same motel with the two other 
individuals who disrupted another 
pipeline in North Dakota. 29 


(U//LES) Unsophisticated, Easily Acquired Tools Used During Attacks: The subjects used 
bolt cutters to gain access to the aboveground maintenance facilities and removed chains 
protecting the valves from being turned off, according to websites supportive of the valve shutoff 


* (U) For background information on tar sands, see Appendix C. 
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action. The individuals then prevented others from regaining control of the valve by attaching 
their own locks. 35 ’ 36 ’ 37 


(U//FOUO) Contingency Plans Made: During one of the attacks against the pipelines, the 
attackers were unable to close a valve and instead simply chained themselves to the pipeline, 
according to US Department of Energy reporting. 38 

(U) Escalation to Violence at DAPL Occupation in North Dakota 

(U//LES) We assess that starting in the summer of 2016, suspected environmental rights 
extremists exploited Native American anti-DAPL protests to attract new members to their 
movement, gain public sympathy, and justify their criminal and violent acts. 39 ’ 40 Native 
American tribes claim the pipeline route crosses sacred sites and burial places, and they are 
concerned a future pipeline rupture could pollute tribal drinking water. 41 We assess the 
significant media attention and public sympathy gained by the environmental rights extremists 
from this new alliance with Native American tribes makes it likely environmental rights 
extremists will attempt to exploit indigenous causes for their own ideological purposes in future 
environment-related events. 42 ' 47 

• (U//LES) Since August 2016, suspected environmental rights extremists have engaged in 
multiple violent incidents in North Dakota at illegal encampments on DAPL and US Army 
Corps of Engineers property in an effort to halt pipeline construction, according to law 
enforcement reporting. 48 ’* The occupation, which ended on 24 March 2017, resulted in 761 
arrests for various crimes—-primarily on charges of criminal trespassing and engaging in a 
riot with individuals who traveled to the region from California, representing the largest 
number of arrests at 115, or 15.1 percent, according to law enforcement reporting. 49 ’ 50 
Individuals have engaged in physical assault and threats of physical assault, as well as use 
of Molotov cocktails and lEDs. 


(U) OBSERVATIONS/TTPS: 



(U//LES) Use of Potentially Lethal Devices: On 27 October 2016, during law enforcement 
clearing of an encampment, an individual shot a firearm at law enforcement officers who had 
confronted her while taking her into custody, according to law enforcement. No injuries were 
reported in that incident. 55 That same day, individuals threw three Molotov cocktails at officers 
during clearing operations, according to media reporting. 56 On 21 November 2016, an 
individual female involved in violent clashes with law enforcement threw small lEDs at officers, 
resulting in near amputation of her arm after one of the lEDs exploded prematurely, according to 


* (U) The Dakota Access Pipeline is sometimes referred to as the Bakken Oil Pipeline. 
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law enforcement and DHS reporting. 57 From 3 to 5 December, individuals, including suspected 
environmental rights extremists, plotted, but did not execute, a coordinated attack on a DAPL 
drili site from all directions. The individuals claimed they would stop the pipeline at all costs and 
were not opposed to using firearms. 58 ' 59,60 

(U//LES) Suspicious Drone Use: On 07 September 2016, three suspected environmental 
rights extremists in Bismarck approached the front gate of the Fraine Barracks—which houses 
several emergency services agencies, the National Guard, and the NDSL 1C—stating they had 
crashed a drone on the property, according to law enforcement. After being informed they could 
not access the site, they asked questions about the barracks before leaving the area. 61 On 23 
October 2016, according to law enforcement, a suspected environmental rights extremist used 
an 18-inch-by-18 inch drone to disrupt law enforcement air operations by flying it within 50 feet 
of a law enforcement helicopter. The same drone was later encountered by law enforcement 
when it flew towards officers approximately 20-30 yards off the ground and then started 
hovering above them. Law enforcement, which attempted to disable the drone with nonlethal 
and lethal munitions due to officer safety concerns, believed the drone was surveilling them, 
according to DHS reporting. We judge this was likely an effort designed to provide advanced 
notice of enforcement operations protecting DAPL construction. 62 ' 63 

(U//LES) Surveillance and Doxing-. Since the beginning of theanti-DAPL campaign in August 
2016, there have been several incidents of suspected environmental rights extremists surveilling 
law enforcement facilities in cities near encampments. We judge these incidents—including 
reports of individuals being photographed entering and exiting a law enforcement facility in 
Mandan and officers being surveyed at their residences and followed by suspicious vehicles— 
were likely an attempt to intimidate officers for theip.role in protecting DAPL construction 
efforts. 64 Personal contact information for a seniof North Dakota Emergency Services (NDDES) 
official accused of removing water from encampments was posted online on 24 August 2016, 
resulting in a sharp increase in harassing phone calls to the NDSLIC against the NDDES 
employee, according to law enforcement. 65 A private security guard for DAPL had her personal 
phone number and e-mail address posted on social media by supporters of the anti-DAPL 
campaign, apparently in reaction to.a'Vevious incident in which she used dogs against an 
aggressive crowd, according to lavv enforcement sources. Another security guard’s children 
were identified on social media, and law enforcement officers reported their home addresses 
had also been posted online. 66 

(U//LES) Travel from Outside the State: On 08 September 2016, members of Canadian 
indigenous tribes took multiple buses from three reservations/territories to participate in the US 
campaign to stop DAPL construction. Suspected violent extremists on these buses reportedly 
carried weapons and riot gear, according to law enforcement, indicating likely intent to commit 
violent acts. 67 ’ 68 Indigenous travel from Canada has been confirmed by Canadian law 
enforcement. 69 As of 24 March 2017, only 51 of the 761 persons arrested for politically 
motivated criminal acts in opposition to DAPL were from North Dakota, according to law 
enforcement. 70 

(U//LES) Call to Arms from Hacking Movements: An individual associating himself or herself 
with the hacking collective Anonymous posted a call for support online, listing the North Dakota 
Highway Patrol and National Guard as possible targets. However, there has been no evidence 
of unusual activity on their networks, according to law enforcement. 71 Additionally, a movement 
called the “Anon Resistance Movement” posted a video on social media advocating for violence 
in solidarity with the anti-DAPL campaign, including further sabotage of pipelines and 
railroads. 72 
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(U//LES) Possible Pre-Operational Surveillance: On 14 November 2016, law enforcement 
received information regarding two suspicious subjects who were encountered twice by law 
enforcement on 11 November 2016 near DAPL drill sites in Patoka and Meredosia, Illinois. The 
individuals claimed to be birdwatchers looking for a local wildlife refuge, and stated they would 
either find a hotel or camp, although officers said they had no camping equipment and appeared 
to be surveying the drill site. The individuals also appeared to be recording the encounter with 
the officer, and one of them had a mapping application open on a cellphone, possibly pinning 
their locations on the map. 73 

(U//FOUO) Vandalism against DAPL Financiers and Vague Online Threats: On 18 
November 2016, a suspected environmental rights extremist indicated the movement’s intent to 
disrupt the financial operations of DAPL by posting a communique on an anarchist website 
claiming credit for vandalizing and "smashing" all the windows of a US bank in Chicago because 
it was "a key investor in the Dakota Access Pipeline." The individual warned other financiers 
with the threat that "it will remain open season on [their] offices, homes, and projects" unless 
they withdraw financial support for DAPL. 74 On 23 November, a suspected environmental rights 
extremist posted a statement to an anarchist website claiming credit for vandalism against a 
second branch of the Chicago bank in retaliation for "atrocities committed against" protestors in 
North Dakota, and blamed the bank for the loss of their "comrade's arm." The individual called 
for vandalism of the bank’s branch offices, ATMs, security cameras, and signs, and then 
demanded that the bank and other DAPL supporters withdraw their support immediately, 
"otherwise you may expect a long night before the dawn." 75 ' 7 ® 

(U//LES) Disruption to Rail Transportation: On 15 
November, suspected environmental rights extremists 
placed debris and abandoned a vehicle with an / 
accelerant-soaked rag hanging out of its gas tank on 
rail tracks near Mandan. Twenty-six individuals were 
arrested in relation to the incident. Delays from this 
attack cost the rail company $2,071.94. On 09 January 
2017, rail employees found jumper cables connected to 
tracks that were painted white and hidden under snow. 

The cables created a signal interruption to the 
conductor, causing delays that cost the business 
$3,544.52. There have been no arrests. The affected 
rail line is one of two non-passenger lines that transport 
Bakken Oil out of North Dakota. 78 ’ 79 Environmental 
rights extremist attacks against railways are typically 
designed to cquse disruption rather than inflict mass 
casualties. However, such activity does introduce 
safety hazards that create the risk of injuries on the 
affected line. 


t;j;i Fip-jre 2 Use (>♦ jumper cables tij 
j disrupt r;TI sitnr! s in Nort*" Dakota in 
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(U//LES) Directed-Energy Weapon: In early to mid-November, suspected environmental 
rights extremists attempted to construct at least one directed-energy device 
designed to disrupt or shut down radio frequencies 
used by law enforcement, according to law 
enforcement sources. If properly configured and 
pointed at a communication network's antenna or 
repeater, such a device could disrupt transmissions 
or cause the system to reset itself, temporarily 
disrupting communications. If aimed at a 
communication network long enough, it Could destroy 
internal components or cause them to catch fire. In 
addition to posing a threat to a communication 
network's antenna or repeater, handheld radio and 
vehicular units are also susceptible to 
electromagnetic interference from such a device. 81 

(U) Use of Fire to Create Barricades: As law 
enforcement was breaking up encampments on 27 October, individuals lit debris and tires on 
fire to create barricades, according to media reporting. 82 

(U) Construction Equipment and Pipelines Targeted in Iowa and the Dakotas 

(U//FOUO) We assess that a series of arsons againstlbwa pipeline construction sites in 2016 
could be indicative of an environmental rights extremist attack—due to the targets’ proximity and 
relationship with DAPL and because the use of arson attacks targeting construction sites is an 
established tactic of the movement. However,.other factors—including a lack of graffiti at the 
crime scene, no claims of responsibility, a lack of historical activity in the region, and public 
controversy over the project’s use of eminent domain—suggest a non-ideological motive. 83 This 
assessment is subject to change if new information emerges. Additionally, environmental rights 
extremism is a plausible motivation behind multiple attacks against construction equipment in 
North Dakota during the same period, as well as a series of attacks puncturing pipelines in Iowa 
and South Dakota in late February and March 2017. 

(U//LES) On 14 September, employees of a construction company reported an unknown 
individual(s) used firearms to shoot several rounds of ammunition into a portable toilet and a 
backhoe at a pipeline construction site near Alexander, North Dakota. According to law 
enforcement, two of the rounds were fired at, but did not penetrate, the backhoe’s fuel tank, which 
could have sparked a fire. There were no injuries, and there have been no arrests or claims 
of responsibility for the attacks- 84 

(U//LES) On 13 September, law enforcement arrested individuals for criminal mischief and 
trespassing after they allegedly sabotaged an under-construction pipeline at a site near New 
Salem, North Dakota by placing a crate of miscellaneous items in the pipe. According to the 
pipeline’s lead safety inspector, had the crate gone undetected, it could have made the pipeline 
into a “pipe bomb” capable of killing bystanders once a “pig” is run through the pipeline.* The 
individuals also broke the keys off in the ignition of machinery and spray-painted the messages 
“WATER IS LIFE,” “NO DAPL,” and “RISE UP!!! ILLINOIS + IOWA NO DAPL.’’ 85 The individuals 
are awaiting trial. 


UNCLASSIFIED 



(U) Figure 3. Use of burning tires and 
vehicles as barricades in North Dakota anti- 
DAPL in October 2016. 80 


* (U) A “pig" Is a device used to check for pipeline leaks. 
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(U//LES) On 6 September, an unknown number of individuals damaged electrical wires of 
construction equipment at an oil pipeline construction site near St. Anthony, North Dakota, creating 
a threat to worker safety. Additionally, the attackers cut hoses, punctured a tire, filled a radiator 
with fire extinguisher suppressant, and filled fuel tanks with dirt. There have been no arrests or 
claims of responsibility.for the attacks. 86 

(U//LES) During the early morning hours of 31 July, 1 August, and 15 October, an unknown 
individual(s) set fires targeting heavy machinery at three construction sites associated with DAPL 
in Mahaska and Jasper Counties, Iowa, resulting in over $3 million in damage. 87 There have been 
no arrests or claims of responsibility for the attacks. 88 ’ 89 ’ 90 ' 91 

(U//LES) On 09 November, an unknown number of individuals set fire to four pieces of heavy 
construction equipment in Buena Vista County, Iowa. According to law enforcement, two 
additional pieces of equipment were prepped for burning but not set on fire. There have been no 
claims of responsibility for the attack. 92 

(U//LES) Between 24 and 25 September, unidentified environmental extremists sabotaged five 
pieces of heavy equipment at DAPL site near Winfred, South Dakota. The sabotage included 
cutting brakes and electrical wiring, causing a potential threat to worker safety. Additionally, dirt 
was found in the motor, and rocks and gravel were found in swing boxes. Estimated damages are 
over $50,000. Two individuals were identified as suspects and provisionally charged with first 
degree vandalism pending arrest. 93 

(U) OBSERVATIONS/TTPS: 

(U//LES) Sabotaging Heavy Equipment: The attackers targeted construction equipment at 
multiple sites—including bulldozers, a track hoe, excavators, and side-booms, according to law 
enforcement reporting. 94 ’ 95 Some of the fires originated in the vehicles’ cab compartments. 96 

(U//LES) Use of Simple Fires: In all cases, the arsons committed against construction equipment 
did not involve use of complex improvised incendiary devices, such as those that employ a time- 
delay mechanism to initiate a fire, according to law enforcement. 97 ’ 98 

(U//LES) Possible Pre-Operational Surveillance: A few days prior to the Mahaska County 
attack, construction workers reported seeing an individual in a vehicle slowly driving past one of 
the construction sites and taking photographs, according to law enforcement. 99 

(U//FOUO) Puncturing Pipelines: Between 28 February and 17 March 2017, an unknown 
number of individuals at multiple DAPL-related aboveground valve stations in Iowa and South 
Dakota used a welding torch or similar tool to pierce segments of pipeline filled with nitrogen gas, 
which is pumped into pipelines to test for leaks. While nitrogen gas is non-flammable and poses 
no physical danger to the public, the hissing sound of gas escaping through puncture holes could 
lead to panic. 100 ' 101 ' 102 Additionally, at an Iowa site that received a similar puncture attack, graffiti 
spray-painted on the control building declared “UR Children Need Water,” “Oil is Death,” and “Mni 
Wiconi”—a phrase that has recently become popular among opponents of DAPL campaign that 
means “water is life" in the Lakota Indian tribe language. 103 
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(U//FOUO) Outlook: Tactics and Drivers of Pipeline-Related Violence in Near Term 

(U//FOUO) We assess environmental rights extremists are likely to use some of these same 
criminal and violent tactics in attempts to disrupt other US energy projects for the remainder of 
2017. Most of these tactics, which are available online for all to see, are relatively easy to carry 
out have perceived utility among environmental rights extremists in the larger effort to halt DAPL 
construction. 

(U//FOUO) We further assess the following developments, if observed, could lead to an increased 
threat of violence in the coming months from environmental rights extremists against pipeline- 
related entities in the Midwest and Western United States: 

• (U//FOUO) High-profile instances or allegations of excessive use offeree during law 
enforcement actions related to pipeline construction; 

• (U//FOUO) Death or serious injury to occupiers at the hands of law enforcement, making 
“martyrs” for the cause; and 

• (U//FOUO) New Canadian pipelines are constructed—such as the Canadian Trans Mountain 
pipeline—potentially creating new grievances and resulting in enhanced sharing of violent 
TTPs between US and Canadian environmental rights extremists. 

(U//FOUO) We assess the following developments, if observed, could lead to a decreased threat 
of violence: 

• (U//FOUO) Law enforcement blockades prevent resupply of remaining occupiers; and 

• (U//FOUO) Indigenous leaders involved in anti-pipeline campaigns ask remaining occupiers to 
leave out of concerns about the impending spring floods along the Missouri River and 
tributaries. 

(U) Intelligence Gaps 

• (U//FOUO) Which camps house individuals who have an interest in using lethal weapons such 
as lEDs against law enforcement or pipeline entities in the future? 

• (U//FOUO) Were training camps established to teach violent tactics to environmental rights 
extremists prior to their arrival in the region? 

• (U//FOUO) Why are individuals conducting surveillance on law enforcement personnel and 
member of their family? 

• (U//FOUO) What coordinated resourcing and funding is available to environmental rights 
extremists? 
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(U//FOUO) Comments, requests, or shareable intelligence may be directed to: STIC at 877-455-7842 or 
STIC@isp.state.il.us; DOI/FC at 515-725-6310 or intca@dps.state.ia.us; MNFC at 651-793-3730 or 
mn.fc@state,mn.us; MATIC at 406-444-1330 or dojintel@rnt.gov; NDSLIC at 701-328-8172 or ndslic@nd.gov; 
SDFC at 866-466-5263 or sdfusioncenter@state.sd.us; WSFC at 877-843-9522 or intake@wsfc.wa.gov. 


(U) Source Summary Statement 

(U) The information used in this FAR is drawn from open source reporting, court documents, and DHS and other law 
enforcement intelligence reports. We have high confidence in the information obtained from DHS, coed, other US 
Government and law enforcement agencies. We have medium confidence in the information obtained from open 
sources, which includes reports from the news media, NGOs, and Internet websites whose information is credibly 
sourced and plausible but may contain biases or unintentional inaccuracies. When possible, open source information 
has been corroborated through other law enforcement and government sources. 

(U//FOUO) We have medium confidence in our assessment that the October 2016 simultaneous valve shutoff attacks 
against five pipelines along the US-Canada border by suspected environmental rights extremists showed a higher level 
of coordination than members of the movement typically exhibit, as our judgment is based on our review of TTPs used in 
historical environmental rights extremist attacks. " • ' 

(U//LES) We have high confidence in our assessment that suspected environmental rights extremists exploited Native 
American causes in furtherance of their own violent agenda during a campaign to halt construction of the DAPL in the 
Midwest and Western United States in 2016. Our judgment is based on press reporting indicating alliances by the larger 
environmental movement and indigenous entities, as well as by environmental rights extremists issuing communiques in 
support of indigenous causes. ' . . 

(U//FOUO) We have low-to-medium confidence in our assessment that while some characteristics of 2016 arsons 
against Iowa pipeline construction could be indicative of an environmental rights extremist attack, other factors could 
reasonably suggest a possible non-ideologicai motive. Our assessment is influenced by the following factors: the 
targets' proximity and relationship with DAPL; arson attacks targeting construction sites are an established tactic of the 
movement; a lack of graffiti and communiques claiming responsibility for the attack; and a lack of attacks from the 
movement in Iowa. Our confidence in this assessment is lessened by the possibility .that new information emerges 
related .to the incident. - . 

(U//FOUO) We have medium confidence in our assessment that environmental rights extremists are likely to use 
some of these same criminal and violent tactics in attempts to disrupt other US energy projects in the coming year. Our 
judgment is based on the fact that most of these tactics being easy to carry out, widely available online, and their 
perceived utility in halting DAPL construction efforts in the remainder of 2017. 




(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers 
should follow established protocols; all other personnel should call 911 or contact local law enforcement. Suspicious 
activity reports (SARs) will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task Force for further action. 
For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. 


(U//LES) Tracked by: PIR-IA-CVE.2.2.2; PIR-IA-CVE.2.2.3 DHS-NFCA-2016/17-KIQ-24 HSEC-8.1, HSEC 8.2; HSEC-8 3' 
HSEC-8.5; HSEC-8.6; HSEC-8.8; HSEC-8.10’ HSEC-10.1; HSEC-10.2’ HSEC-10.5’ HSEC-10.6; HSEC-10.8; HSEC-10 10’’ 
IADOIFC-17-IRT1; IADOIFC-17-IRK1; IADOIFC-17-IRV6; MATIC-05.5.2015; MN01.3; MN07.1; ND-HSEC 8.1; ND-HSEC 
8.2; ND-HSEC 8.3; ND-HSEC 8.5; ND-HSEC 8.6; ND-HSEC 8.8; ND-HSEC 8.10; ND-HSEC 10.1; ND-HSEC10.2; ND- 
HSEC 10.5; ND-HSEC 10.6; ND-HSEC 10.8; ND-HSEC 10.10; HSEC-02-02000-P1-SD-2010; HSEC-02-03000-P1-SD- 
2010; STIC-SIN-8.1; STIC-SIN-12.1; STIC-SIN-12.7; STIC-SIN-12.11; WSFC-1.11 WSFC-1.3.1; WSFC-1 5’ WSFC-1 6' 
WSFC-1.8.1; WSFC-1.8.2; WSFC-1.8.3; WSFC-1.9.5; WSFC-1.10.1. 
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(U) Appendix A: The Dakota Access Pipeline 

(U//LES) The Dakota Access Pipeline project is an underway $3.78 billion construction project 
to build a 1,172-mile, 30-inch diameter pipeline for transporting US light sweet crude oil from 
the Bakken and Three Forks production areas of North Dakota to existing pipelines in Patoka, 
Illinois for further distribution to refining markets. 104 DAPL construction attracted controversy 
as a result of a North Dakota-based indigenous tribe’s claims that pipeline leaks would 
contaminate the water supply of their reservation. 105 In July 2016, the tribe filed a lawsuit 
against the US Army Corps of Engineers for its role in granting permits to build the pipeline. 106 
The lawsuit spurred a series of protests and demonstrations near the reservation. 107 Members 
of other Indian tribes—as well as environmental rights extremists who share the tribes’ 
underlying goal of halting construction of the pipeline—have traveled from across the United 
States and Canada to join the occupation. 108 ' 109 Since August 2016, there have been 
hundreds of arrests for criminal and violent incidents at encampments set up by anti-pipeline 
groups and nearby DAPL-related sites in an effort to stymie construction efforts. 110 ' 111 
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(U) Appendix B: Prior Energy Sector Attacks by Environmental Rights 
Extremists 

(U//FOUO) The pipeline attacks in the Midwest and Western United States in the latter half 
of 2016 were the first significant environmental rights extremist attacks targeting the 
transportation and energy sectors since September 2015. The last known attack specifically 
targeting a pipeline occurred in Texas in 2012. 

• (U//LES) On 16 September 2015, environmental rights extremist Rory Lynn 
Gunderman exchanged gunfire with South Dakota law enforcement officers and then 
fatally shot himself. Subsequently, law enforcement officers located Gunderman’s 
remote campsite in Custer County, South Dakota, where they discovered a stolen 
weapon, digital media, and the components necessary to manufacture numerous 
lEDs. 113 According to recovered evidence, Gunderman purchased numerous IED 
components in Spearfish, South Dakota on 8 September 2015. 114 Analysis of digital 
media in Gunderman’s possession revealed recently accessed copies of al-Qa‘ida in 
the Arabian Peninsula’s Inspire magazine, including editions 1,10, and 12. 115 Though 
the exact targets and timing of Gunderman’s plot remain unknown, his behavior and 
statements indicated a fixation on the energy sector. 116 Gunderman additionally 
claimed membership in the Crescent City, California-based Deep Green 
Resistance USPER . Though the group maintains it only engages in nonviolent activities, 
the organization promotes the belief that a separate “underground” is needed to 
conduct violent “direct action” in order to save humanity and other life on earth from 
environmental disaster. This violent direct ation would include attacks against critical 
infrastructure “to disrupt and dismantle industrial civilization.” 117 

• (U//LES) In September 2014, a suspected environmental rights extremist(s) in 
Washington stole a bulldozer and drove it into the base of a US Department of Energy 
500-kilovolt powerline tower in an apparent attempt to knock the tower down. The 
incident did not result in any significant damage. Graffiti associated with anti-capitalism 
and environmental rights extremism was spray-painted at the scene and on nearby 
structures. Graffiti included the phrase “#killcap” (“Kill Capitalism”), “Corrupt Society,” 
and “ELF," the acronym for the environmental rights extremist movement Earth 
Liberation Front. The case is currently under investigation. 118 ’ 119 

• (U) From 17 to 18 June 2012, environmental rights extremist Anson Chi USPER set off a 
series of explosive devices on top of an Atmos USPER gas pipeline in Plano, Texas. Chi 
intended to damage the pipeline and disrupt natural gas flow. He was sentenced to 20 
years in prison without parole on 30 June 2014. 120 ' 121 Chi pled guilty to a charge of 
attempting to destroy a natural gas pipeline used in interstate commerce, and to a 
charge of possessing an explosive device not registered with the National Firearms 
Registration and Transfer Record. 122 Chi also contacted well known convicted bomber 
Theodore Kaczynski USPER to be a mentor; Kaczynski eventually broke off contact and 
told Chi to seek professional help. 123 
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(U) Appendix C: Tar Sands 

(U) Several pipelines along the US-Canadian border carry crude oil into the United States for 
refinement and distribution. 124 Alberta, Canada has one of the world’s largest deposits of a 
particularly thick and heavy form of crude oil known as tar sands oil. Tar sands oil is 
controversial because of perceived negative impacts to the environment that occur during 
mining, processing, and transporting the oil—such as large C0 2 emissions contributing to 
climate change, contamination of groundwater during extraction, and destruction of natural 
resources used by indigenous tribes. 125 In October 2016, US environmental rights extremists 
engaged in coordinated attacks to disrupt five border pipelines perceived to be transporting 
tar sands oil from Canada into the United States. 126 
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(U//FOUO) Appendix D: Behavioral Indicators of Planned Criminal 
or Violent Activities Targeting Pipelines 

(U//FOUO) There are a number of potential behaviors and indicators of planned criminal or 

violent activities targeting pipelines and associated entities. Some of these behavioral 

indicators may be constitutionally protected activities and should be supported by additional 

facts to justify increased suspicions. 

• (U//FOUO) Planning of violent activities related to major protests on message boards, social 
networking sites, or in Internet chat rooms; 

• (U//FOUO) Reports of rhetoric indicating a desire to manually close pipeline valves or engage in 
violence targeting pipelines and associated entitities; 

• (U//FOUO) Possession of bolt cutters to cut security fencing or locks and homemade devices to 
chain oneself to pipeline valves or construction equipment; 

• (U//FOUO) Reports of graffiti threatening violence related to a pipeline; 

• (U//FOUO) Threatening phone calls or e-mails to corportate executives, businesses, or 
contractors associated with pipeline construction efforts; 

• (U//FOUO) Signs of trespassing or suspicious persons in construction areas—-possibly 
indicating pre-incident surveillance; 

• (U//FOUO) Reports of individuals wearing all dark or black clothing and masks or bandanas 
without a reasonable explanation; 

• (U//FOUO) Possession of sharp or blunt objects (knives, axes, machetes, dowels, tire irons) or 
illegal firearms during protests; 

• (U//FOUO) Reports of attacks on opposition vehicles, possibly involving lighting them on fire or 
using them as roadblocks; 

• (U//FOUO) Reports of individuals acquiring materials that could be used to build improvised 
incendiary devices (e.g., propane gas canisters) or lEDs without a reasonable explanation; 

• (U//FOUO) Reports of individuals moving heavy materials (e.g., fences, tires, trashcans, or 
dumpsters) to make barricades during protests, possibly with the intention to light them on fire; 

• (U//FOUO) Reports of individuals pilfering bricks, rebar, or pipes from construction sites for use 
as potential projectiles; 

• (U//FOUO) Pre-staging of bricks, rocks, or debris near protest sites for possible use as 
weapons; 

• (U//FOUO) Reports of individuals carpooling from other locations to engage in planned criminal 
or violent acts during protests; and 

• (U//FOUO) Reports of drivers not obeying law enforcement directions at traffic control 
checkpoints. 
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